Cryptography and PKI Flashcards

An organization is deploying code signing for its software releases. Which control MOST effectively prevents tampering with signed binaries after release?

Answer: Detached signatures stored separately from the binary

Detached signatures are stored separately so recipients can verify the binary independently, and any modification to the binary invalidates the signature.

Which key management practice MOST reduces the risk of key compromise over time?

Answer: Implementing automated key rotation with defined cryptoperiods

Defined cryptoperiods with automated rotation limit the exposure window if a key is compromised and reduce the data volume encrypted under any single key.

A certificate authority issues a wildcard certificate for *.example.com. Which domain is NOT covered by this certificate?

Answer: sub.mail.example.com

Wildcard certificates cover exactly one level of subdomain; sub.mail.example.com has two subdomain levels below example.com and is not covered by *.example.com.

Which cryptographic primitive is used to derive multiple keys from a single shared secret in TLS?

Answer: HMAC-based Key Derivation Function (HKDF)

HKDF uses HMAC to extract entropy from the shared secret and then expand it into keying material for multiple purposes (encryption, MAC, IV) within the TLS session.

Which attack exploits predictable initialization vectors (IVs) in CBC mode encryption?

Answer: BEAST (Browser Exploit Against SSL/TLS)

BEAST exploited predictable IVs in TLS 1.0 CBC mode, allowing an attacker to perform a chosen-plaintext attack and decrypt session data.

An enterprise needs quantum-resistant encryption for long-lived sensitive data. Which NIST-standardized post-quantum algorithm is appropriate for key encapsulation?

Answer: CRYSTALS-Kyber (ML-KEM)

CRYSTALS-Kyber (standardized as ML-KEM in NIST FIPS 203) is NIST's approved post-quantum key encapsulation mechanism, resistant to attacks by quantum computers.